| From 50b7f1b7236bab08ebbbecf90521e84b068d7a17 Mon Sep 17 00:00:00 2001 |
| From: Cornelia Huck <cohuck@redhat.com> |
| Date: Mon, 11 Mar 2019 10:59:53 +0100 |
| Subject: vfio: ccw: only free cp on final interrupt |
| |
| From: Cornelia Huck <cohuck@redhat.com> |
| |
| commit 50b7f1b7236bab08ebbbecf90521e84b068d7a17 upstream. |
| |
| When we get an interrupt for a channel program, it is not |
| necessarily the final interrupt; for example, the issuing |
| guest may request an intermediate interrupt by specifying |
| the program-controlled-interrupt flag on a ccw. |
| |
| We must not switch the state to idle if the interrupt is not |
| yet final; even more importantly, we must not free the translated |
| channel program if the interrupt is not yet final, or the host |
| can crash during cp rewind. |
| |
| Fixes: e5f84dbaea59 ("vfio: ccw: return I/O results asynchronously") |
| Cc: stable@vger.kernel.org # v4.12+ |
| Reviewed-by: Eric Farman <farman@linux.ibm.com> |
| Signed-off-by: Cornelia Huck <cohuck@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/s390/cio/vfio_ccw_drv.c | 8 ++++++-- |
| 1 file changed, 6 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/s390/cio/vfio_ccw_drv.c |
| +++ b/drivers/s390/cio/vfio_ccw_drv.c |
| @@ -70,20 +70,24 @@ static void vfio_ccw_sch_io_todo(struct |
| { |
| struct vfio_ccw_private *private; |
| struct irb *irb; |
| + bool is_final; |
| |
| private = container_of(work, struct vfio_ccw_private, io_work); |
| irb = &private->irb; |
| |
| + is_final = !(scsw_actl(&irb->scsw) & |
| + (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); |
| if (scsw_is_solicited(&irb->scsw)) { |
| cp_update_scsw(&private->cp, &irb->scsw); |
| - cp_free(&private->cp); |
| + if (is_final) |
| + cp_free(&private->cp); |
| } |
| memcpy(private->io_region.irb_area, irb, sizeof(*irb)); |
| |
| if (private->io_trigger) |
| eventfd_signal(private->io_trigger, 1); |
| |
| - if (private->mdev) |
| + if (private->mdev && is_final) |
| private->state = VFIO_CCW_STATE_IDLE; |
| } |
| |